CVE-2026-42876
published 2026-05-11CVE-2026-42876: External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who…
PriorityP426medium4.9CVSS 3.1
AVNACHPRLUINSCCLILAN
EPSS
0.26%
16.5th percentile
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who only has permission to create ExternalSecret resources can cause the operator to create a Secret that Kubernetes will automatically populate with a long-lived token for the specified service account. This effectively allows the user to impersonate any service account in the namespace without needing direct create permissions on TokenRequest or Secrets of that type. This vulnerability is fixed in 2.4.1.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| external-secrets | external-secrets | < 2.4.1 | 2.4.1 |
| github.com | external-secrets_external-secrets_apis | >= 0.1.0 < 2.4.1 | 2.4.1 |
CVSS provenance
nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
vendor_redhat4.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
ExternalSecrets vulnerable to privilege escalation with secret overwriting
ghsa·2026-05-08
CVE-2026-42876 [MEDIUM] ExternalSecrets vulnerable to privilege escalation with secret overwriting
ExternalSecrets vulnerable to privilege escalation with secret overwriting
ExternalSecrets allows users to craft Service Account tokens for misconfigured Service Accounts in namespaces the users have access to.
### Impact
A user who only has permission to create ExternalSecret resources can cause the operator to create a Secret that Kubernetes will automatically populate with a long-lived token for the sepcified service account. This effectively allows the user to impersonate any service account in the namespace without needing direct create permissions on TokenRequest or Secrets of that type.
The problem is mitigated in severity by the fact that the user must have pre-existing permissions already at almost the same level as the escalation later gives. The attacker cannot use this meth
Red Hat
external-secrets-operator: External Secrets Operator: Privilege escalation via ExternalSecret resource creation
vendor_redhat·2026-05-11·CVSS 4.9
CVE-2026-42876 [MEDIUM] CWE-266 external-secrets-operator: External Secrets Operator: Privilege escalation via ExternalSecret resource creation
external-secrets-operator: External Secrets Operator: Privilege escalation via ExternalSecret resource creation
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who only has permission to create ExternalSecret resources can cause the operator to create a Secret that Kubernetes will automatically populate with a long-lived token for the specified service account. This effectively allows the user to impersonate any service account in the namespace without needing direct create permissions on TokenRequest or Secrets of that type. This vulnerability is fixed in 2.4.1.
A flaw was found in External Secrets Operator. A user with permissions to create ExternalSecret resources can trick the op
No detection rules found.
No public exploits indexed.
2026-05-11
Published